From nobody Mon Sep 29 20:16:02 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id D1F0CC3F6B0 for ; Mon, 15 Aug 2022 22:29:35 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1347103AbiHOW3b (ORCPT ); Mon, 15 Aug 2022 18:29:31 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34314 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1348357AbiHOWXI (ORCPT ); Mon, 15 Aug 2022 18:23:08 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CD9951256DE; Mon, 15 Aug 2022 12:44:06 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id AA6636068D; Mon, 15 Aug 2022 19:44:05 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 964A2C433C1; Mon, 15 Aug 2022 19:44:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1660592645; bh=dTvCjq362IS86Z1I6lrrYgBBtQVKVYdvi1jWP7T5AoU=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=B7DVEEFRB3I1HvmzNmmJtO4NXPhdO8ZY3bZL65ajEhYheHQono9WuYK8Vg5tLUL+H 36kqA3iYOFCCLRBVaJQABwr7A9sNw4XWZHJnNEz2TNQ1WCV5xhrBT4ucZPKw+LFDh2 Y8S/hWB5nFHMaffPZ6urQu9us/dFRTkfE36teH1w= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Thadeu Lima de Souza Cascardo , Pablo Neira Ayuso Subject: [PATCH 5.19 0142/1157] netfilter: nf_tables: do not allow RULE_ID to refer to another chain Date: Mon, 15 Aug 2022 19:51:38 +0200 Message-Id: <20220815180445.317714795@linuxfoundation.org> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20220815180439.416659447@linuxfoundation.org> References: <20220815180439.416659447@linuxfoundation.org> User-Agent: quilt/0.67 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" From: Thadeu Lima de Souza Cascardo commit 36d5b2913219ac853908b0f1c664345e04313856 upstream. When doing lookups for rules on the same batch by using its ID, a rule from a different chain can be used. If a rule is added to a chain but tries to be positioned next to a rule from a different chain, it will be linked to chain2, but the use counter on chain1 would be the one to be incremented. When looking for rules by ID, use the chain that was used for the lookup by name. The chain used in the context copied to the transaction needs to match that same chain. That way, struct nft_rule does not need to get enlarged with another member. Fixes: 1a94e38d254b ("netfilter: nf_tables: add NFTA_RULE_ID attribute") Fixes: 75dd48e2e420 ("netfilter: nf_tables: Support RULE_ID reference in ne= w rule") Signed-off-by: Thadeu Lima de Souza Cascardo Cc: Signed-off-by: Pablo Neira Ayuso Signed-off-by: Greg Kroah-Hartman --- net/netfilter/nf_tables_api.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/net/netfilter/nf_tables_api.c +++ b/net/netfilter/nf_tables_api.c @@ -3373,6 +3373,7 @@ static int nft_table_validate(struct net } =20 static struct nft_rule *nft_rule_lookup_byid(const struct net *net, + const struct nft_chain *chain, const struct nlattr *nla); =20 #define NFT_RULE_MAXEXPRS 128 @@ -3461,7 +3462,7 @@ static int nf_tables_newrule(struct sk_b return PTR_ERR(old_rule); } } else if (nla[NFTA_RULE_POSITION_ID]) { - old_rule =3D nft_rule_lookup_byid(net, nla[NFTA_RULE_POSITION_ID]); + old_rule =3D nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_POSITION_ID= ]); if (IS_ERR(old_rule)) { NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_POSITION_ID]); return PTR_ERR(old_rule); @@ -3606,6 +3607,7 @@ err_release_expr: } =20 static struct nft_rule *nft_rule_lookup_byid(const struct net *net, + const struct nft_chain *chain, const struct nlattr *nla) { struct nftables_pernet *nft_net =3D nft_pernet(net); @@ -3616,6 +3618,7 @@ static struct nft_rule *nft_rule_lookup_ struct nft_rule *rule =3D nft_trans_rule(trans); =20 if (trans->msg_type =3D=3D NFT_MSG_NEWRULE && + trans->ctx.chain =3D=3D chain && id =3D=3D nft_trans_rule_id(trans)) return rule; } @@ -3665,7 +3668,7 @@ static int nf_tables_delrule(struct sk_b =20 err =3D nft_delrule(&ctx, rule); } else if (nla[NFTA_RULE_ID]) { - rule =3D nft_rule_lookup_byid(net, nla[NFTA_RULE_ID]); + rule =3D nft_rule_lookup_byid(net, chain, nla[NFTA_RULE_ID]); if (IS_ERR(rule)) { NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_ID]); return PTR_ERR(rule);